Menu
McDonald’s India asks users to update app after data leak report

McDonald’s India asks users to update app after data leak report

Security firm Fallible claims the app is still leaking personal information

McDonald’s India operation asked users to update their McDelivery app as a 'precautionary measure' after a security firm said it had found that it was leaking personal data of over 2.2 million users.

The Indian operation of the food chain, which is owned and managed by franchisees, said in posts on Facebook and Twitter over the weekend that its website and app do not store any sensitive financial data of users.

The operation did not admit or deny that there had been a breach, but urged users to update the online ordering app as a precautionary measure. “The website and app has always been safe to use, and we update security measure on regular basis,” according to the post.

Security firm Fallible claimed in a post Friday that the app is leaking personal data for more than 2.2 million of its users, which include their name, email address, phone number, home address and coordinates and social profile links.

It said it had contacted McDelivery with the issue on Feb 7 and received an acknowledgement from a senior IT manager on Feb 13, but there hadn’t been information about a fix from the company even after 33 days.

Fallible said “an unprotected publicly accessible API endpoint for getting user details coupled with serially enumerable integers as customer IDs can be used to obtain access to all users personal information.”

In an update, Fallible said McDonald's India had replied to the firm that they have fixed the issue and would be releasing an official statement asking users to upgrade the app, but in another update the security firm claimed that the fix was incomplete and the endpoint is still leaking data.

McDonald’s did not immediately comment over the weekend.

A user of the app, Srinivas Kodali wrote in a Twitter message that he had filed a complaint with police in Hyderabad in South India against McDonald’s under Section 43A of the country's Information Technology Act, which makes companies liable to pay damages for the compromise of sensitive personal data as a result of their failure in implementing and maintaining reasonable security practices.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
Show Comments